karajan-code 3.1.0 → 3.2.0

package/packages/hu-board/src/server.js

@@ -10,13 +10,14 @@ import { fullScan, startWatcher } from './sync.js';
 import apiRoutes from './routes/api.js';
 import pipelineRoutes from './routes/pipeline.js';
 import ragRoutes from './routes/rag.js';
+import wikiRoutes from './routes/wiki.js';
 import { authMiddleware } from './auth.js';
 import { getOrCreateToken, getTokenPath } from './token-store.js';
 import { reapZombieSessions } from './zombie-reaper.js';
 import { reapZombieHus } from './hu-zombie-reaper.js';
 import { setHuStatus as setHuStatusPlanMutation, setHuFailResult as setHuFailResultPlanMutation } from './plan-mutations.js';
 import { cleanupEphemeralProjects } from './ephemeral-cleaner.js';
-import { findAvailablePort as findAvailablePortBase } from '../../../src/utils/port-check.js';
+import { findAvailablePort as findAvailablePortBase } from '@karajan/core/port-check';
 
 /**
  * Path to the PID file the CLI's `kj board start` / `kj board stop`
@@ -237,7 +238,7 @@ async function main() {
   //   - cooldownUntil > now  → re-programa setTimeout que dispara en cooldown
   // Idempotente (lockfile per session). Cero polling.
   try {
-    const { reconcileAll } = await import('../../../src/brain/standby-scheduler.js');
+    const { reconcileAll } = await import('@karajan/core/standby-scheduler');
     const { spawn } = await import('node:child_process');
     const { join, dirname } = await import('node:path');
     const { fileURLToPath } = await import('node:url');
@@ -300,6 +301,7 @@ async function main() {
   app.use('/api', buildRateLimiter(), authMiddleware(), apiRoutes);
   app.use('/api/pipeline', authMiddleware(), pipelineRoutes);
   app.use('/api/rag', authMiddleware(), ragRoutes);
+  app.use('/api/wiki', authMiddleware(), wikiRoutes);
 
   // SPA fallback: serve index.html for non-API, non-static routes
   app.get('/{*splat}', (_req, res) => {

package/packages/hu-board/src/sync.js

@@ -14,7 +14,7 @@ import {
   removeTombstone,
 } from './db.js';
 import { publish as publishEvent } from './event-bus.js';
-import { getSharedPlansDir, SHARED_DIR_NAME, isSharedPath } from '../../../src/utils/shared-paths.js';
+import { getSharedPlansDir, SHARED_DIR_NAME, isSharedPath } from '@karajan/core/shared-paths';
 import { readConfig } from './config-yaml.js';
 
 /**

package/scripts/git-hooks/post-merge

@@ -3,5 +3,16 @@
 # never serves stale code. Installed by `kj rag install-hooks`. The marker
 # in this comment is how the installer tells kj-managed hooks from user hooks.
 set -euo pipefail
-if ! command -v kj >/dev/null 2>&1; then exit 0; fi
-kj rag index --since auto >/dev/null 2>&1 || true
+if command -v kj >/dev/null 2>&1; then
+  kj rag index --since auto >/dev/null 2>&1 || true
+fi
+
+# KJC-TSK-0507 — Refresh the per-project QMD semantic wiki when the merge
+# touched indexable folders (docs/, .reviews/, .karajan/plans/). Background
+# so it never blocks the user's `git pull` / `git merge`.
+if command -v qmd >/dev/null 2>&1; then
+  if git diff-tree -r --name-only ORIG_HEAD HEAD 2>/dev/null \
+      | grep -qE '^(docs/|\.reviews/|\.karajan/plans/)'; then
+    (qmd update >/dev/null 2>&1 || true) &
+  fi
+fi

package/src/audit/ai-slop-findings.js

@@ -0,0 +1,102 @@
+// AI-slop tells detector — KJC-TSK-0503. Deterministic, offline,
+// regex-based scanner over JS/TS source. Five categories:
+// tautologic-comments, banner-separators, boilerplate-docstrings,
+// magic-fallbacks, redundant-jsdoc. Score 100 = clean.
+
+import fs from "node:fs";
+import path from "node:path";
+
+const FILE_EXTS = new Set([".js", ".mjs", ".cjs", ".ts", ".tsx", ".jsx"]);
+const IGNORE_DIRS = new Set([
+  "node_modules", "dist", "build", "coverage",
+  ".git", ".karajan", "public", ".next", ".nuxt", ".vercel", ".cache",
+]);
+const VERB = "(?:returns?|gets?|sets?|fetches?|loads?|saves?|creates?|builds?|makes?|computes?|handles?|checks?|validates?)";
+const LINE_PATTERNS = {
+  "banner-separators": /\/[/*]\s*[=*\-_#~]{5,}/,
+  "magic-fallbacks": /(\?\?|\|\|)\s*(?:""|''|null|undefined)\s*(?:\)|;|,|$)/,
+  "redundant-jsdoc": new RegExp(`@param\\s+\\{[^}]+\\}\\s+(\\w+)\\s+(?:-\\s*)?(?:the\\s+)?\\1\\s+(?:parameter|argument|value)`, "i"),
+};
+const TAUT_RE = new RegExp(`^\\s*//\\s*${VERB}\\s+(?:the\\s+|a\\s+|an\\s+)?(\\w+)\\s*\\.?\\s*$`, "i");
+const DOC_RE = new RegExp(`^\\s*/\\*\\*\\s*${VERB}\\s+(?:the\\s+|a\\s+|an\\s+)?(\\w+)\\s*\\.?\\s*\\*/\\s*$`, "i");
+const DECL_RE = /^\s*(?:export\s+)?(?:default\s+)?(?:async\s+)?(?:function|const|let|var|class)\s+(\w+)/;
+
+export const CATEGORIES = Object.freeze([
+  "tautologic-comments", "banner-separators", "boilerplate-docstrings",
+  "magic-fallbacks", "redundant-jsdoc",
+]);
+
+function nextDecl(lines, from) {
+  for (let j = from; j < Math.min(from + 3, lines.length); j++) {
+    const m = lines[j]?.match(DECL_RE);
+    if (m) return m[1];
+  }
+  return null;
+}
+const stem = (a, b) => { const al = a.toLowerCase(), bl = b.toLowerCase(); return al === bl || al.includes(bl) || bl.includes(al); };
+
+export function scanText(relPath, text) {
+  const out = [];
+  const lines = text.split(/\r?\n/);
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    const lineNo = i + 1;
+    for (const [category, re] of Object.entries(LINE_PATTERNS)) {
+      if (re.test(line)) out.push({ path: relPath, line: lineNo, category, snippet: line.trim().slice(0, 100) });
+    }
+    const t = line.match(TAUT_RE);
+    if (t) {
+      const decl = nextDecl(lines, i + 1);
+      if (decl && stem(decl, t[1])) out.push({ path: relPath, line: lineNo, category: "tautologic-comments", snippet: line.trim().slice(0, 100) });
+    }
+    const d = line.match(DOC_RE);
+    if (d) {
+      const decl = nextDecl(lines, i + 1);
+      if (decl && stem(decl, d[1])) out.push({ path: relPath, line: lineNo, category: "boilerplate-docstrings", snippet: line.trim().slice(0, 100) });
+    }
+  }
+  return out;
+}
+
+function listSourceFiles(root) {
+  const out = [];
+  const stack = [root];
+  while (stack.length) {
+    const dir = stack.pop();
+    let entries;
+    try { entries = fs.readdirSync(dir, { withFileTypes: true }); } catch { continue; }
+    for (const e of entries) {
+      const full = path.join(dir, e.name);
+      if (e.isDirectory()) {
+        if (IGNORE_DIRS.has(e.name) || e.name.startsWith(".")) continue;
+        stack.push(full);
+      } else if (FILE_EXTS.has(path.extname(e.name))) out.push(full);
+    }
+  }
+  return out;
+}
+
+export async function collectAiSlop(rootDir, opts = {}) {
+  const maxLOC = Number.isFinite(opts.maxLOC) ? opts.maxLOC : 200_000;
+  const maxWorst = Number.isFinite(opts.maxWorst) ? opts.maxWorst : 10;
+  try {
+    const findings = [];
+    let totalLOC = 0, filesScanned = 0;
+    for (const file of listSourceFiles(rootDir)) {
+      if (totalLOC >= maxLOC) break;
+      let content;
+      try { content = fs.readFileSync(file, "utf-8"); } catch { continue; }
+      findings.push(...scanText(path.relative(rootDir, file) || file, content));
+      totalLOC += content.split(/\r?\n/).length;
+      filesScanned++;
+    }
+    const byCategory = Object.fromEntries(CATEGORIES.map((c) => [c, 0]));
+    for (const f of findings) byCategory[f.category]++;
+    const density = totalLOC > 0 ? (findings.length / totalLOC) * 100 : 0;
+    const score = Math.max(0, Math.min(100, Math.round(100 - density * 100)));
+    const worst = findings.slice().sort((a, b) => (a.path === b.path ? a.line - b.line : a.path.localeCompare(b.path))).slice(0, maxWorst);
+    return { available: true, filesScanned, totalLOC, total: findings.length, score, byCategory, worst };
+  } catch (err) {
+    return { available: false, reason: err?.message || String(err) };
+  }
+}

package/src/audit/deterministic-summary.js

@@ -41,11 +41,28 @@ export function formatDeterministicSummary(ctx) {
   if (ctx.circularDeps) lines.push(...formatCircularDepsBlock(ctx.circularDeps));
   if (ctx.deadExports) lines.push(...formatDeadExportsBlock(ctx.deadExports));
   if (ctx.injectionFindings) lines.push(...formatInjectionBlock(ctx.injectionFindings));
+  if (ctx.aiSlop) lines.push(...formatAiSlopBlock(ctx.aiSlop));
   if (ctx.webperf) lines.push(...formatWebperfBlock(ctx.webperf));
 
   return lines.join("\n");
 }
 
+function formatAiSlopBlock(slop) {
+  if (!slop.available) return ["### AI-slop tells (deterministic)", `- Status: not available — ${slop.reason || "scan failed"}`, ""];
+  const lines = ["### AI-slop tells (deterministic)", `- Files scanned: ${slop.filesScanned ?? 0}`, `- Score: ${slop.score}/100 (100 = clean)`, `- Findings: ${slop.total ?? 0}`];
+  if ((slop.total ?? 0) > 0) {
+    for (const [cat, n] of Object.entries(slop.byCategory || {})) {
+      if (n > 0) lines.push(`  - ${cat}: ${n}`);
+    }
+    if (Array.isArray(slop.worst) && slop.worst.length > 0) {
+      lines.push("  - Worst offenders:");
+      for (const f of slop.worst) lines.push(`    - ${f.path}:${f.line} [${f.category}] ${f.snippet}`);
+    }
+  }
+  lines.push("");
+  return lines;
+}
+
 function formatInjectionBlock(inj) {
   if (!inj.available) return ["### Prompt-injection scan", `- Status: not available — ${inj.reason || "scan failed"}`, ""];
   const lines = ["### Prompt-injection scan (specs / domain / onboarding)", `- Files scanned: ${inj.scanned ?? 0}`, `- Findings: ${inj.total ?? 0}`];
@@ -278,5 +295,6 @@ export function deterministicContextHasFindings(ctx) {
   if (ctx.circularDeps?.available && (ctx.circularDeps.total ?? 0) > 0) return true;
   if (ctx.deadExports?.available && (ctx.deadExports.total ?? 0) > 0) return true;
   if (ctx.growthDelta && (Math.abs(ctx.growthDelta.lines || 0) > 100 || Math.abs(ctx.growthDelta.deps || 0) > 0)) return true;
+  if (ctx.aiSlop?.available && (ctx.aiSlop.total ?? 0) > 0) return true;
   return false;
 }

package/src/brain/standby-scheduler.js

@@ -1,92 +1,10 @@
-// KJC-TSK-0414 PR 1: scheduler event-driven para hibernación.
-//
-// Diseño: setTimeout único por sesión, dispara EXACTAMENTE en cooldownUntil.
-// Cero polling. Si el proceso muere antes del fire, reconcileAll() al
-// arrancar el board re-programa los timeouts pendientes (o reanuda
-// inmediatamente los expirados).
-
-import { listPendingStandby, acquireStandbyLock, markStandbyDone } from "./standby-store.js";
-
-// Mapa sessionId → NodeJS.Timeout — accesible para test/cancel.
-const _scheduled = new Map();
-
-export function _resetScheduledForTests() {
-  for (const t of _scheduled.values()) clearTimeout(t);
-  _scheduled.clear();
-}
-
-/**
- * Programa un único setTimeout que dispara `onResume(sessionId)` en cooldownUntil.
- *
- * @param {object} args
- * @param {string} args.sessionId
- * @param {string} args.cooldownUntil - ISO timestamp
- * @param {Function} args.onResume - callback(sessionId) cuando llega el momento
- * @param {object} [args.logger]
- * @returns {{ scheduled: boolean, msUntil?: number, immediate?: boolean }}
- */
-export function scheduleResume({ sessionId, cooldownUntil, onResume, logger }) {
-  if (!sessionId || !cooldownUntil || typeof onResume !== "function") {
-    return { scheduled: false };
-  }
-  cancelScheduled(sessionId);
-  const targetMs = new Date(cooldownUntil).getTime();
-  if (Number.isNaN(targetMs)) return { scheduled: false };
-  const delay = targetMs - Date.now();
-  if (delay <= 0) {
-    // Ya expiró — reanudar inmediato (caso: board reiniciado tras llegar la hora).
-    logger?.info?.(`[standby-scheduler] ${sessionId}: cooldown ya expirado, resume inmediato`);
-    Promise.resolve().then(() => onResume(sessionId)).catch(() => { /* swallow */ });
-    return { scheduled: true, immediate: true };
-  }
-  const timer = setTimeout(() => {
-    _scheduled.delete(sessionId);
-    logger?.info?.(`[standby-scheduler] ${sessionId}: cooldown alcanzado, disparando resume`);
-    try { onResume(sessionId); } catch (err) { logger?.warn?.(`[standby-scheduler] onResume threw: ${err.message}`); }
-  }, delay);
-  if (typeof timer.unref === "function") timer.unref();
-  _scheduled.set(sessionId, timer);
-  logger?.info?.(`[standby-scheduler] ${sessionId}: scheduled in ${Math.round(delay / 1000)}s (until ${cooldownUntil})`);
-  return { scheduled: true, msUntil: delay };
-}
-
-/** Cancela el setTimeout de una sesión (caso: usuario hizo kj resume manual). */
-export function cancelScheduled(sessionId) {
-  const t = _scheduled.get(sessionId);
-  if (!t) return false;
-  clearTimeout(t);
-  _scheduled.delete(sessionId);
-  return true;
-}
-
-/**
- * Reconciliación al arrancar el board / kj. Lee todas las sesiones pendientes
- * y para cada una:
- *   - cooldownUntil < now → onResume inmediato
- *   - cooldownUntil > now → re-programa setTimeout
- *
- * Idempotente: el lockfile en standby-store previene dobles spawns si
- * reconcileAll() corre dos veces concurrentes (board reload).
- *
- * @param {object} args
- * @param {Function} args.onResume - callback(sessionId)
- * @param {object} [args.logger]
- * @returns {{ scheduled: number, immediate: number, total: number }}
- */
-export function reconcileAll({ onResume, logger }) {
-  const sessions = listPendingStandby();
-  let scheduled = 0;
-  let immediate = 0;
-  for (const s of sessions) {
-    if (!s?.sessionId || !s?.cooldownUntil) continue;
-    const r = scheduleResume({ sessionId: s.sessionId, cooldownUntil: s.cooldownUntil, onResume, logger });
-    if (r.scheduled && r.immediate) immediate += 1;
-    else if (r.scheduled) scheduled += 1;
-  }
-  logger?.info?.(`[standby-scheduler] reconcile: ${sessions.length} sesiones (${immediate} resume inmediato, ${scheduled} programadas)`);
-  return { scheduled, immediate, total: sessions.length };
-}
-
-// Re-export para que callers no tengan que importar standby-store si solo
-// necesitan el flow scheduler → lock → done.
-export { acquireStandbyLock, markStandbyDone };
+// Shim de compatibilidad: standby-scheduler vive ahora en @karajan/core.
+// Mantiene la ruta para callers internos del CLI.
+export {
+  _resetScheduledForTests,
+  scheduleResume,
+  cancelScheduled,
+  reconcileAll,
+  acquireStandbyLock,
+  markStandbyDone,
+} from "@karajan/core/standby-scheduler";

package/src/brain/standby-store.js

@@ -1,168 +1,12 @@
-// KJC-TSK-0414 PR 1: persistencia de sesiones hibernadas al disco.
-//
-// Cuando Brain decide hibernar (QUOTA_EXHAUSTED_DAILY con retryAfter > 5min),
-// serializa el estado completo del run en ~/.kj/standby/<sessionId>.json.
-// El proceso de kj run muere (exit 0) tras persistir; el board (o kj resume)
-// lo reanuda cuando llega cooldownUntil.
-//
-// Layout en disco:
-//   ~/.kj/standby/
-//     <sessionId>.json    ← sesiones pendientes (scheduler les mete setTimeout)
-//     <sessionId>.lock    ← lockfile durante spawn de kj resume
-//     done/
-//       <sessionId>.json  ← finalizadas (consumibles por GC en TSK-0414 PR3)
-
-import fs from "node:fs";
-import path from "node:path";
-import { writeJsonAtomicSync } from "../utils/atomic-write.js";
-import { resolveHome } from "../utils/paths.js";
-
-const FILENAME_RE = /^[a-zA-Z0-9._-]+\.json$/;
-
-// Delegates to the unified resolver. PR 3 of KJC-PCS-0047 switched
-// the default to `.karajan` — hibernated sessions now persist under
-// `~/.karajan/standby/`, migrated automatically from the legacy
-// `~/.kj/standby/` on the next `kj` invocation.
-function getKjHome() {
-  return resolveHome({ defaultSegment: ".karajan" });
-}
-
-export function standbyDir() {
-  return path.join(getKjHome(), "standby");
-}
-
-export function standbyDoneDir() {
-  return path.join(standbyDir(), "done");
-}
-
-function sanitizeId(sessionId) {
-  if (!sessionId || typeof sessionId !== "string") throw new Error("sessionId requerido");
-  return sessionId.replaceAll(/[^a-zA-Z0-9._-]/g, "_").slice(0, 120);
-}
-
-/**
- * Persiste el estado completo de un run hibernado.
- *
- * @param {object} state - shape:
- *   { sessionId, planId?, huId?, role, iteration?, prompt, agentConfig,
- *     retryCount?, cooldownUntil, reason, snapshot_sha?, outcome_so_far? }
- * @returns {string} path absoluto del JSON escrito
- */
-export function persistStandby(state) {
-  if (!state || !state.sessionId) throw new Error("state.sessionId requerido");
-  if (!state.cooldownUntil) throw new Error("state.cooldownUntil requerido");
-  const dir = standbyDir();
-  fs.mkdirSync(dir, { recursive: true });
-  const file = path.join(dir, `${sanitizeId(state.sessionId)}.json`);
-  const payload = {
-    ...state,
-    createdAt: state.createdAt || new Date().toISOString(),
-    persistedAt: new Date().toISOString(),
-  };
-  writeJsonAtomicSync(file, payload);
-  return file;
-}
-
-// Only these env vars are carried into the standby snapshot. NEVER
-// persist the whole `process.env` — that would leak API keys and other
-// secrets into ~/.kj/standby/*.json. `kj standby resume` re-spawns with
-// the live env merged on top, so the snapshot only needs what is needed
-// to relaunch from the right place.
-const STANDBY_ENV_ALLOWLIST = ["KJ_HOME", "HOME", "PATH"];
-
-/**
- * Builds the `sessionState` object that `withBrainRecovery` persists when
- * a run hibernates. Pulls the session id, the relaunch metadata and an
- * allowlisted env subset so `kj standby resume` can re-spawn the command.
- * @param {object} args
- * @param {object} args.session    - the pipeline session ({ id, plan_id? })
- * @param {object} [args.config]   - resolved config ({ projectDir?, plan? })
- * @param {string|null} [args.huId]
- * @returns {object|null} sessionState, or null when there is no session id
- */
-export function buildStandbyState({ session, config = {}, huId = null } = {}) {
-  if (!session?.id) return null;
-  const env = {};
-  for (const key of STANDBY_ENV_ALLOWLIST) {
-    if (process.env[key] != null) env[key] = process.env[key];
-  }
-  for (const [key, value] of Object.entries(process.env)) {
-    if (key.startsWith("KJ_") && value != null) env[key] = value;
-  }
-  return {
-    sessionId: session.id,
-    planId: session.plan_id || config.plan || null,
-    huId: huId || null,
-    argv: process.argv.slice(2),
-    cwd: config.projectDir || process.cwd(),
-    env,
-  };
-}
-
-/**
- * @param {string} sessionId
- * @returns {object|null}
- */
-export function loadStandby(sessionId) {
-  const file = path.join(standbyDir(), `${sanitizeId(sessionId)}.json`);
-  if (!fs.existsSync(file)) return null;
-  try {
-    return JSON.parse(fs.readFileSync(file, "utf-8"));
-  } catch {
-    return null;
-  }
-}
-
-/**
- * Lista todas las sesiones pendientes (no las de done/).
- * @returns {object[]}
- */
-export function listPendingStandby() {
-  const dir = standbyDir();
-  if (!fs.existsSync(dir)) return [];
-  return fs.readdirSync(dir)
-    .filter((f) => FILENAME_RE.test(f))
-    .map((f) => {
-      try {
-        return JSON.parse(fs.readFileSync(path.join(dir, f), "utf-8"));
-      } catch {
-        return null;
-      }
-    })
-    .filter(Boolean);
-}
-
-/**
- * Mueve una sesión a done/ — consumible por GC en TSK-0414 PR3.
- * @param {string} sessionId
- * @returns {boolean} true si se movió
- */
-export function markStandbyDone(sessionId) {
-  const id = sanitizeId(sessionId);
-  const src = path.join(standbyDir(), `${id}.json`);
-  if (!fs.existsSync(src)) return false;
-  const doneDir = standbyDoneDir();
-  fs.mkdirSync(doneDir, { recursive: true });
-  const dst = path.join(doneDir, `${id}-${Date.now()}.json`);
-  fs.renameSync(src, dst);
-  return true;
-}
-
-/**
- * Lockfile para evitar dobles spawns de kj resume sobre la misma sesión.
- * Devuelve { acquired: true, release: () => void } o { acquired: false } si ya hay lock.
- *
- * @param {string} sessionId
- * @returns {{ acquired: boolean, release?: Function }}
- */
-export function acquireStandbyLock(sessionId) {
-  const id = sanitizeId(sessionId);
-  const lockFile = path.join(standbyDir(), `${id}.lock`);
-  try {
-    fs.mkdirSync(standbyDir(), { recursive: true });
-    fs.writeFileSync(lockFile, String(process.pid), { flag: "wx" });
-    return { acquired: true, release: () => { try { fs.unlinkSync(lockFile); } catch { /* */ } } };
-  } catch {
-    return { acquired: false };
-  }
-}
+// Shim de compatibilidad: standby-store vive ahora en @karajan/core.
+// Mantiene la ruta para callers internos del CLI.
+export {
+  standbyDir,
+  standbyDoneDir,
+  persistStandby,
+  buildStandbyState,
+  loadStandby,
+  listPendingStandby,
+  markStandbyDone,
+  acquireStandbyLock,
+} from "@karajan/core/standby-store";

package/src/checks/ai-trash.js

@@ -0,0 +1,34 @@
+/**
+ * ai-trash safety net availability check (KJC-TSK-0391).
+ * Surfaces a WARN in `kj doctor` when the `kj-trash` binary is missing,
+ * since the PreToolUse hook cannot snapshot destructive ops without it.
+ * The remediation is `kj-trash install --claude-code` once the binary is
+ * on PATH (the workspace ships it with karajan-code).
+ */
+
+import { detectAiTrash } from "../utils/ai-trash.js";
+import { STRATEGY } from "./types.js";
+
+function createAiTrashCheck() {
+  return {
+    name: "ai-trash",
+    label: "ai-trash safety net",
+    strategy: STRATEGY.MANUAL,
+    async detect() {
+      const res = await detectAiTrash();
+      if (res.available) {
+        return { ok: true, severity: "info", detail: "kj-trash present — preventive safety net active" };
+      }
+      return {
+        ok: false,
+        severity: "warn",
+        detail: "kj-trash not found — destructive ops unprotected",
+        fix: "Reinstall karajan-code (kj-trash ships with the workspace) and run `kj-trash install --claude-code`",
+      };
+    },
+  };
+}
+
+export function getAiTrashChecks() {
+  return [createAiTrashCheck()];
+}

package/src/checks/qmd.js

@@ -0,0 +1,41 @@
+/**
+ * QMD availability check. Manual strategy — installation
+ * depends on the host platform and is handled by getInstallCommand().
+ *
+ * QMD (Quick Markdown Search) provides semantic search over the
+ * user's wiki / docs / notes collections. Karajan ships it as a
+ * default integration (mirror of Squeezr): kj init installs it,
+ * kj doctor reports its presence.
+ */
+
+import { runCommand } from "../utils/process.js";
+import { getInstallCommand } from "../utils/os-detect.js";
+import { withDocLink } from "../utils/doc-links.js";
+import { STRATEGY } from "./types.js";
+
+function createQmdCheck() {
+  return {
+    name: "qmd",
+    label: "QMD",
+    strategy: STRATEGY.MANUAL,
+    async detect() {
+      try {
+        const res = await runCommand("qmd", ["--version"]);
+        if (res.exitCode === 0) {
+          return { ok: true, severity: "info", detail: `${res.stdout.trim()} — semantic wiki active` };
+        }
+      } catch { /* not installed */ }
+      const installCmd = getInstallCommand("qmd");
+      return {
+        ok: false,
+        severity: "warn",
+        detail: "Not found — semantic wiki via QMD available",
+        fix: withDocLink(`Install: ${installCmd}`, "qmd_install"),
+      };
+    },
+  };
+}
+
+export function getQmdChecks() {
+  return [createQmdCheck()];
+}

package/src/checks/squeezr.js

@@ -0,0 +1,36 @@
+/**
+ * Squeezr availability check. Manual strategy — installation
+ * depends on the host platform and is handled by getInstallCommand().
+ */
+
+import { runCommand } from "../utils/process.js";
+import { getInstallCommand } from "../utils/os-detect.js";
+import { withDocLink } from "../utils/doc-links.js";
+import { STRATEGY } from "./types.js";
+
+function createSqueezrCheck() {
+  return {
+    name: "squeezr",
+    label: "Squeezr",
+    strategy: STRATEGY.MANUAL,
+    async detect() {
+      try {
+        const res = await runCommand("squeezr", ["--version"]);
+        if (res.exitCode === 0) {
+          return { ok: true, severity: "info", detail: `${res.stdout.trim()} — context compression active` };
+        }
+      } catch { /* not installed */ }
+      const installCmd = getInstallCommand("squeezr");
+      return {
+        ok: false,
+        severity: "warn",
+        detail: "Not found — context compression via Squeezr available",
+        fix: withDocLink(`Install: ${installCmd}`, "squeezr_install"),
+      };
+    },
+  };
+}
+
+export function getSqueezrChecks() {
+  return [createSqueezrCheck()];
+}

package/src/cli/register-meta.js

@@ -4,6 +4,7 @@ import { researcherCommand } from "../commands/researcher.js";
 import { architectCommand } from "../commands/architect.js";
 import { onboardCommand } from "../commands/onboard.js";
 import { ragIndexCommand, ragQueryCommand, ragInstallHooksCommand, ragEvalCommand } from "../commands/rag.js";
+import { qmdQueryCommand } from "../commands/qmd.js";
 import { ragMcpCommand } from "../commands/rag-mcp.js";
 import { watchStartCommand, watchStopCommand, watchStatusCommand } from "../commands/watch.js";
 import { auditCommand } from "../commands/audit.js";
@@ -172,6 +173,24 @@ export function registerMeta(program, { pkgVersion }) {
       await ragMcpCommand();
     });
 
+  // KJC-TSK-0509 — `kj qmd query` is a thin wrapper around the upstream
+  // `qmd` binary that auto-resolves the project's collection (rag = agent
+  // context; qmd = human wiki). One subcommand for now; index/add live in
+  // `kj init` and `kj rag install-hooks` (post-merge reindex).
+  const qmd = program.command("qmd").description("Semantic search over the per-project QMD wiki (docs/, .reviews/, .karajan/plans/)");
+  qmd.command("query <text>")
+    .description("Run a qmd query against the wiki collection of the current project")
+    .option("--collection <name>", "Override the auto-resolved <slug>-<suffix> collection name")
+    .option("--scope <name>", "docs (default) | reviews | plans", "docs")
+    .option("--top-k <n>", "Number of hits to return (1..50, default 10)", "10")
+    .option("--fast", "Skip the LLM reranker (faster, slightly noisier hits)")
+    .option("--json", "Emit the raw JSON array for piping to jq")
+    .action(async (text, flags) => {
+      await withConfig(pkgVersion, "qmd-query", flags, async ({ config, logger }) => {
+        await qmdQueryCommand({ text, config, logger, flags });
+      });
+    });
+
   // KJC-TSK-0441 — `kj watch [start|stop|status]` for live RAG re-index.
   const watch = program.command("watch").description("Live RAG re-index daemon");
   watch.command("start").description("Start the watcher daemon").option("--foreground", "Run in foreground (do not detach)").option("--with-sources", "Watch project source files too").action(async (flags) => {
@@ -197,6 +216,7 @@ export function registerMeta(program, { pkgVersion }) {
     .option("--no-osv", "Skip the OSV-Scanner vulnerability collector. Findings are also skipped automatically when osv-scanner is not installed.")
     .option("--no-semgrep", "Skip the Semgrep SAST collector. Findings are also skipped automatically when semgrep is not installed (install via 'pipx install semgrep' or 'brew install semgrep').")
     .option("--no-harness", "Skip the AI Harness Scorecard stage (Docker one-shot). Auto-skipped when Docker is unavailable. Each run is also persisted to .karajan/audit-history.db (KJC-TSK-0472) for diff/trend tracking.")
+    .option("--no-ai-slop", "Skip the AI-slop tells collector (deterministic regex scan for tautologic comments, banner separators, boilerplate docstrings, magic fallbacks, redundant JSDoc). KJC-TSK-0503.")
     .option("--trend", "Append a sparkline of the harness score across the last 10 runs (uses .karajan/audit-history.db). KJC-TSK-0473.")
     .option("--report-file <path>", "Write the audit report to disk in addition to stdout. <path> may be a file (extension drives format: .md or .json) or a directory (creates audit-<ISO>.<md|json> inside). $KJ_AUDIT_REPORT_DIR env var is used as default directory if no --report-file is given.")
     .option("--deterministic-only", "Skip the LLM analysis entirely. Print/persist only the deterministic findings (basalCost, sonar, stack, growth-delta, webperf). Zero tokens spent. Compatible with --report-file and --json.")
@@ -220,6 +240,7 @@ export function registerMeta(program, { pkgVersion }) {
           noOsv: flags.osv === false,
           noSemgrep: flags.semgrep === false,
           noHarness: flags.harness === false,
+          noAiSlop: flags.aiSlop === false,
           reportFile: flags.reportFile || null,
           deterministicOnly: Boolean(flags.deterministicOnly),
           yes: Boolean(flags.yes),

package/src/cli/register-pipeline.js

@@ -27,6 +27,9 @@ export function registerPipeline(program, { pkgVersion }) {
     .option("--global", "Save config to ~/.karajan/kj.config.yml (skip the scope wizard)")
     .option("--local", "Save config to ./.karajan/kj.config.yml (skip the scope wizard)")
     .option("--no-ollama", "Skip the RAG embedder bootstrap (Ollama-in-Docker). Useful on modest hardware or when an external embedder will be wired manually")
+    .option("--no-rtk", "Skip the RTK auto-install (token savings on Bash outputs). Karajan still runs but burns more tokens")
+    .option("--no-squeezr", "Skip the Squeezr auto-install (context compression). Karajan still runs but burns more tokens")
+    .option("--no-qmd", "Skip the QMD auto-install + collection registration (semantic wiki over docs/, .reviews/ and plans/)")
     .action(async (flags) => {
       await withConfig(pkgVersion, "init", flags, async ({ config: _config, logger }) => {
         await initCommand({ logger, flags });